The Privacy Act 1988 is Australia's principal data-protection law, setting the Australian Privacy Principles that govern how personal information is collected, used, and disclosed. It is the privacy foundation the Consumer Data Right is built on top of — the CDR adds a data-sharing right and its own privacy safeguards, but the Privacy Act is the baseline any Australian financial-data sharing has to respect.
Privacy Act 1988
The Privacy Act 1988 is the law that governs personal information in Australia, through the Australian Privacy Principles (APPs). It predates open banking by decades, and the Consumer Data Right was deliberately layered on top of it rather than replacing it.
- The Australian Privacy Principles - Thirteen principles covering collection, use, disclosure, quality, and security of personal information, enforced by the Office of the Australian Information Commissioner.
- The CDR’s foundation - The Consumer Data Right adds a sharing right and CDR-specific privacy safeguards, but the Privacy Act is the baseline the whole regime respects.
- The consent backdrop - Every CDR consent operates against the Privacy Act’s expectations for how personal information is handled.
The Privacy Act is the reason Australia’s open-banking consent model looks the way it does — a data-sharing right bolted onto an existing privacy regime. It is a useful counterpart to Europe’s GDPR: the same idea that open banking is a consented movement of personal data, and that the movement is only lawful because a privacy law underneath it says how.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Australian Banking APIs
The privacy baseline the CDR's consent and data-sharing safeguards sit on top of.
